CVE-2026-77001

CVE-2026-77001 describes an unauthenticated authentication bypass vulnerability found in the "Social Login & Sharing buttons with Analytics By SoClever" WordPress plugin, specifically affecting versions up to and including 1.2.0. This flaw stems from the plugin's failure to perform authentication, authorization, or nonce checks within one of its publicly accessible login handlers. As a result, an unauthenticated attacker can exploit this vulnerability to obtain a valid session as any existing user on the WordPress site. This includes the ability to gain a session as an administrator, potentially without needing to know any account credentials.